Strategies for Electronic Exchange of Substance Abuse Treatment Records

Strategies for Electronic Exchange of Substance Abuse Treatment Records Patricia Gray, J. D., LL. M. Prepared for the Texas Health and Human Services Commission and the Texas Health Services Authority with support from the State Health Information Exchange Cooperative Agreement Program February 2013

STRATEGIES FOR ELECTRONIC EXCHANGE OF SUBSTANCE ABUSE TREATMENT RECORDS Patricia Gray, J. D., LL. M. University of Houston Law Center Health Law & Policy Institute The management of individually identifiable health information related to substance abuse treatment presents complex issues when that information is subject to electronic exchange in a system used by multiple entities. In general, under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule, a patient s protected health information (PHI) may be disclosed to other providers without specific patient authorization when the disclosure is for purposes of treatment, for certain health care operations and for purposes of securing payment for treatment provided. However, under federal regulations, a substance abuse treatment record from a federally supported treatment program may not be disclosed, even for treatment or payment purposes, unless the patient provides specific written authorization for release of the record. 1 The only treatment exception to this restriction on release of substance abuse treatment records is for treatment provided in a medical emergency. 2 In addition, substance abuse treatment records present special problems to resolve for issues such as access to records by personal representatives, treatment involving minors, disclosure requested by law enforcement officials and re-disclosure of information that has been transmitted to another provider. APPLICABLE STATE LAW AND THE PRIVACY RULE Both in-patient and out-patient treatment of chemically dependent 3 persons is governed in Texas under Chapter 462 of the Texas Health and Safety Code. Patients may voluntarily submit to treatment or they may be involuntarily committed for treatment through a court proceeding. Records of involuntary commitment proceedings are characterized as public records of a private nature. 4 In order for any record of a court proceeding to be released, a judge must find that such access is justified and in the public interest or that the person about whom such record is created has consented to its release. 5 In addition, if any part of the records used in a proceeding is governed by a law relating to confidentiality of mental health information or if physician patient privilege applies, the court must also find that access to the record is justified under a statutory exemption related to such confidentiality or privilege. 6 Patients under the age of 18 may be 1 Substance Abuse and Mental Health Servs. Admn., Frequently Asked Questions: Applying the Substance Abuse Confidentiality Regulations to Health Information Exchange (HIE) available at http://www.samhsa.gov/healthprivacy.docs/ehr-faqs.pdf (hereinafter SAMHSA 2010 guidance). 2 Id. 3 TEX. HEALTH & SAFETY CODE 462.001(3) defines chemical dependency to include the abuse of alcohol or a controlled substance; psychological or physical dependence on alcohol or a controlled substance; or addiction to alcohol or a controlled substance. For purposes of this paper, the term substance abuse is used. 4 Tex. H&S Code TEX. HEALTH & SAFETY CODE 462.003(a). 5 TEX. HEALTH & SAFETY CODE 462.003(b). 6 TEX. HEALTH & SAFETY CODE 462.003(c). 1

involuntarily committed for treatment by a patient s parent, managing conservator or guardian. 7 Minors age 16 and older may also voluntarily consent to substance abuse treatment. 8 There is no specific Texas statutory reference for protection of PHI found in treatment records for substance abuse. However, in the Health & Safety Code provisions related to confidentiality of mental health records, Texas incorporates alcoholism and drug addiction into the list of conditions about which a patient might consult a professional for diagnosis, evaluation, or treatment. 9 The primary distinction between Texas protection of mental health records and federal requirements related to protection of substance abuse treatment records is that Texas state law allows disclosure without specific patient authorization for treatment and payment purposes and for certain operations between state-supported facilities for treatment of the mentally ill. 10 Federal requirements governing substance abuse treatment are discussed more fully in the next section below. The Texas Prescription Program 11 authorizes the Texas Department of Public Safety (DPS) to monitor prescribing of all controlled substances listed on Schedules II through V, including those prescribed for treatment of substance abuse. The DPS director is charged with protecting data submitted by prescribing health providers from access by anyone except specified investigators engaged in enforcement actions related to misuse of prescription drugs. All information submitted to the director under this program remains confidential regardless of whether access is allowed for investigative purposes. 12 In addition, any statistical reports disseminated to the public must remove all information reasonably likely to reveal the identity of a specific patient or provider. 13 The director must also ensure that there are no retrievable records in the information retrieval system that can be used to identify any particular patient. 14 It should also be noted that, under federal regulations, no information obtained by any undercover agent or informant, even if authorized by court order to obtain such information, can be used to criminally investigate or to prosecute any patient. 15 FEDERAL REGULATION AND THE PRIVACY RULE The federal regulations governing restrictions on disclosure of information from substance abuse treatment records in federally supported treatment facilities and programs are found at 42 C.F.R. Part 2 and are commonly referred to as the Part 2 regulations. 16 Although the restrictions found in the Part 2 regulations are only applicable to federally supported treatment facilities and programs as defined in the regulations, there are some circumstances in which 7 TEX. HEALTH & SAFETY CODE 462.009(a)(1). 8 TEX. HEALTH & SAFETY CODE 462.022(a)(3)(B). 9 TEX. HEALTH & SAFETY CODE 611.001(1). 10 TEX. HEALTH & SAFETY CODE 611.004. 11 Available at http://www.txdps.state.tx.us/regulatoryservices/prescription_program/prescriptionforms.htm. 12 TEX. HEALTH & SAFETY CODE 481.076 (i). 13 TEX. HEALTH & SAFETY CODE 481.076(d)(3). 14 TEX. HEALTH & SAFETY CODE 481.076(e). 15 42 C.F.R. 2.17. 16 Available at http://www.ecfr.gov/ 2

information related to a particular patient will not be subject to the restrictions of the Part 2 regulations. Understanding those nuances is important for protection of both patients and providers. In general, a program is deemed to receive federal assistance if it is conducted under specific authorization of a federal agency (such as certification as a Medicare provider or licensure by the DEA to prescribe controlled substances) or receives federal funds in any form, even if the funds are not paid in direct support of treatment (such as having a tax exempt status or allowance of tax deductions for contributions). 17 The restrictions on release of substance abuse treatment information cover any information, including information on referral and intake, and are applicable both to private practitioners as well as to programs that hold themselves out as providing substance abuse diagnosis, treatment or referral for treatment, including, but not limited to, rehabilitation programs, employee assistance programs, programs within general hospitals, [and] school-based programs. 18 Definitions Affecting Determination of Patient, Record, and Program Patient means any individual who has applied for or been given diagnosis or treatment for alcohol or drug abuse at a federally assisted program. The definition also includes an individual who, after arrest on a criminal charge, is identified as an alcohol or drug abuser in order to determine that individual s eligibility to participate in a program. 19 Patient identifying information includes any information, including, but not limited to, the name, address, social security number, driver s license number, fingerprints, or photographs which can be used to identify a patient with reasonable accuracy and speed either directly or by reference to other publicly available information.. 20 Record includes any information, whether recorded or not that relates to a patient and that was received or acquired by a federally assisted alcohol or drug program. 21 The definition of program for purposes of compliance with Part 2 regulations focuses on whether the entity or individual holds out or promotes itself to the community as a provider of substance abuse treatment. 22 Included in the definition are: Any individual or entity (other than a general medical care facility) that holds itself out as providing, and provides alcohol or drug abuse diagnosis, treatment, or referral for treatment; or 17 42 C.F.R. 2.12(b)(1-4). 18 42 C.F.R. 2.12(e). 19 42 C. F.R. 2.11. 20 Id. 21 Id. 22 42 C.F.R. 2.12(e). 3

An identified unit within a general medical care facility that holds itself out as providing, and provides alcohol or drug abuse diagnosis, treatment or referral for treatment; or Medical personnel or other staff in a general medical care facility whose primary function is the provision of alcohol or drug abuse diagnosis, treatment or referral for treatment and who are identified as such providers. 23 These provisions appear to generally exclude applicability of Part 2 regulations to information obtained by a primary care physician, health plan, pharmacy, or even a mental health unit of a general medical care facility treating patients who may have a diagnosis of substance abuse. Recently revised guidance from the Substance Abuse and Mental Health Services Administration (SAMHSA) clarifies the circumstances under which Part 2 regulations may or may not apply. 24 The guidance notes that either the practitioner or the entity must meet the requirement of holding out that it provides, and in fact does provide, alcohol or drug abuse diagnosis, treatment or referral for treatment. While the phrase holding out is not defined in the regulations, the guidance notes that it could include (but is not limited to) state licensing procedures, advertising or the posting of notices in the offices, certifications in addiction medicine, listings in registries, internet statements, consultation activities for non-[substance abuse]-program practitioners, information presented to patients or their families, or any activity that would lead one to reasonably conclude that the provider is providing or provides alcohol or drug abuse diagnosis, treatment or referral for treatment. 25 This clarification on the requirement of holding out a particular intent to provide substance abuse treatment is intended to provide relief for primary care physicians who prescribe controlled substances for management of a substance abuse disorder, but who do not otherwise engage in treatment of substance abuse disorders. Because such physicians have to obtain a special license from a federal agency (DEA) to prescribe such controlled substances they meet part of the test for being subject to the restrictions of the Part 2 regulations. However, unless they also hold out that they are substance abuse treatment providers, they do not meet the additional criteria to be subject to such restrictions. 26 The guidance further clarifies that hospitals, trauma centers, or federally qualified health centers would generally be considered general medical facilities for purposes of applicability of Part 2 regulations. 27 However, general medical facilities can also have identified units within their facilities, as well as primary care physicians that, by virtue of holding out that 23 42 C.F.R. 2.11. 24 Substance Abuse and Mental Health Servs. Admn., Applying the Substance Abuse Confidentiality Regulations 42 CFR Part 2 (Revised 12/14/11), Q-10 and A-10 at pp. 6-7, available at www.samhsa.gov/about/laws/samhsa_42cfrpart2faqii_revised.pdf (hereinafter SAMHSA 2011 guidance). 25 Id. 26 Id. 27 Id. 4

they provide, and that do provide alcohol and drug abuse diagnosis, treatment or referral for treatment, are covered by the restrictions of the Part 2 regulations. 28 Requirements for Release of Information Substance abuse treatment programs must comply with both Part 2 requirements as well as any applicable requirements of the HIPAA Privacy Rule. In general, this means that substance abuse treatment programs will comply with the Part 2 requirements restricting disclosure of information from treatment records. If there is an applicable exception to the Part 2 requirements that permits disclosure, then programs must ensure that provisions of the Privacy Rule are followed. 29 The Part 2 regulations use the term consent in the same way that the Privacy Rule utilizes the term authorization. For purposes of this paper, when referring to requirements of the Part 2 regulations, the term consent will be used. The primary difference between Part 2 regulations and the Privacy Rule is that Part 2 regulations do not permit the disclosure of PHI without patient consent for purposes of treatment, payment or health care operations. 30 In addition, the elements needed for a valid Part 2 consent for disclosure are more stringent than those required under the Privacy Rule for authorizing disclosure. A valid Part 2 consent must include all of the following elements: (1) The specific name or general designation of the program or person permitted to make the disclosure. (2) The name or title of the individual or the name of the organization to which disclosure is to be made. (3) The name of the patient. (4) The purpose of the disclosure. (5) How much and what kind of information is to be disclosed. (6) The signature of the patient, and, when required for a minor, the signature of a person authorized to give consent ; or, when required for a patient who is incompetent or deceased, the signature of a person authorized to sign in lieu of the patient. (7) The date on which the consent is signed. (8) A statement that the consent is subject to revocation at any time except to the extent that the program or person which is to make the disclosure has already acted in reliance on it. Acting in reliance includes the provision of treatment services in reliance on a valid consent to disclose information to a third party payer. 31 A Part 2 consent cannot be signed by someone acting on behalf of a patient under a power of attorney. A person signing a Part 2 consent on behalf of a patient must be either a 28 Id. 29 Substance Abuse and Mental Health Servs. Admn., The Confidentiality of Alcohol and Drug Abuse Patient Records Regulation and the HIPAA Privacy Rule: Implications for Alcohol and Substance Abuse Programs (June, 2004) available at http://www.hipaa.samhsa.gov/download2/samhsapart2-hipaacomparison2004.pdf (hereinafter SAMHSA 2004 guidance). 30 SAMHSA 2010 guidance, supra note 1. 31 42 C.F.R. 2.31. 5

parent (if authorized under applicable state law) 32 or someone who has been appointed as a guardian or personal representative by a court of competent jurisdiction. 33 In addition, the following written statement must accompany each disclosure made pursuant to a patient s written consent. This information has been disclosed to you from records protected by Federal confidentiality rules (42 CFR part 2). The Federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose. The Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient. 34 No disclosure may be made based on a patient s written authorization if the person holding the records knows, or could through reasonable effort know, that the authorization is false. 35 Additional Requirements for Authorization Under the Privacy Rule A Part 2 consent signed for purposes for which authorization would be required under the Privacy Rule (i.e., marketing, sale of information, access to psychotherapy notes), must also contain a statement placing a patient from a substance abuse treatment program on notice of the ability or inability of the program to condition treatment, payment, enrollment in a health plan, or eligibility for benefits on whether or not a patient will authorize disclosure of information, or if conditions apply, the consequences to the individual for refusing to sign an authorization. 36 If a Part 2 consent is signed by a patient s personal representative, the consent must include a description of the person s authority to act on behalf of the patient. 37 Part 2 Disclosures Permitted Without Patient Consent There are three circumstances under which disclosures from substance abuse treatment records are permitted without specific patient consent. The first relates to providing care in a medical emergency: patient identifying information may be disclosed to medical personnel who have a need for information about a patient for the purpose of treating a condition which poses an immediate threat to the health of 32 42 C.F.R. 2.14. 33 42 C.F.R. 2.14-2.15. 34 42 C. F. R. 2.32. 35 42 C.F.R. 2.31(c)(4). 36 45 C.F.R. 164.508(c)(2)(ii). 37 45 C.F.R. 164.508(c)(1)(vi). 6

any individual and which requires immediate medical intervention. 38 In addition, medical personnel may receive information to identify patients who may be at risk for a potential medical emergency such as a potential drug interaction. 39 If a disclosure is made in response to a medical emergency, the disclosure can only be made to medical personnel, 40 and must be documented in the patient s record. 41 The second permitted disclosure absent specific patient consent is for the purpose of conducting approved research that meets stringent requirements for protection of any patient identifying information. 42 Finally, disclosure without specific patient consent is allowed for certain program audits and evaluations, including review of services by third party payers or quality improvement organizations conducting a utilization review or quality control review. As with the research requirements, those responsible for conducting the audits or evaluations must agree to provide for the security of any patient identifying information. 43 Other Relationships Between Part 2 Regulations and the Privacy Rule The Privacy Rule establishes a minimum necessary standard in order to limit wholesale disclosure of PHI when a more limited amount of information is sufficient to accomplish the intended purpose of the request for the information 44 and requires covered entities to establish policies and procedures to implement and comply with this standard. 45 However, the Privacy Rule does not apply a minimum necessary standard to requests for or disclosure of PHI for purposes of treatment, for disclosure made pursuant to a patient s consent or authorization, or for other purposes as required or authorized by the Privacy Rule. Substance abuse programs, on the other hand, must limit all disclosures (except those made directly to the patient) to only that information necessary to carry the purpose of the requested disclosure. 46 The limitations on what information can be compelled for production under subpoena or court order are set out in detail at 42 C.F.R. part 2, subpart E. 47 A patient may consent to release of information that is requested in a subpoena, but if the patient refuses to consent, then a court of competent jurisdiction must review the request and issue a specific court order with a 38 42 C.F.R. 2.51(a). 39 SAMHSA 2011 guidance, supra note 24 at 5. 40 42 C.F.R. 2.51. 41 SAMHSA 2004 guidance supra note 29 at 9. 42 42 C.F.R. 2.52. 43 42 C.F.R. 2.53. 44 45 C.F.R. 164.502(b). 45 45 C.F.R. 164.514(d). 46 SAMHSA 2004 guidance supra note 29 at 9. 47 42 C.F.R. 2.61-2.67. 7

subpoena to secure the information. 48 The Privacy Rule does not set specific standards for obtaining a court order or issuance of a subpoena. 49 Similarly, the Privacy Rule permits disclosure of PHI about any individual, child or adult, which a covered entity reasonably believes to be the victim of abuse, neglect or domestic violence without patient consent to designated entities authorized to receive such reports. 50 Part 2 regulations, however, limit reports of abuse only to an initial report of child abuse as may be required under state law, 51 but maintain restrictions on disclosure of any additional information in response to any follow up requests. 52 Both the Privacy Rule and the Part 2 regulations require that patients receive notice of the laws and regulations to protect the confidentiality of their PHI, though each has slightly different requirements for what the notice must include. 53 The Privacy Rule requires that patients receive notice of a program s privacy practices as well as their rights under the Privacy Rule. 54 The Part 2 regulations also require that patients receive notice of their rights under regulations governing the confidentiality of their treatment records, and that the notice also include a summary of the applicable regulations. 55 The Part 2 regulations are generally more restrictive than requirements of the Privacy Rule, but to the extent that other administrative requirements found in the Privacy Rule are not in direct conflict with the requirements of Part 2 regulations, substance abuse programs must comply with the standard that is most supportive of a patient s right to control their own medical information and its disclosure. Some of these requirements include patients rights to access their own medical records, to request restriction on uses or disclosures, to request an amendment of their records, and to receive an accounting of disclosures from those records. Business Associates and Qualified Service Organizations A health information exchange (HIE) may be a business associate of a substance abuse program as well as a Qualified Service Organization to the substance abuse program. Proposed modifications to the HIPAA Privacy, Security, and Enforcement Rules under the Health Information Technology for Economics and Clinical Health Act (HITECH) 56 expand the definition of business associate as it currently exists in the Privacy Rule to specifically bring electronic health information exchanges and health information organizations under the auspices 48 42 C.F.R. 2.61(a). 49 45 C.F.R. 164.51(f). 50 45 C.F.R. 164.512(c). 51 42 C.F.R. 2.12(c)(6). 52 SAMHSA 2004 guidance supra note 29 at 8. 53 Id. at 12-14. 54 45 C.F.R. 164.520. 55 42 C.F.R. 2.22. 56 American Recovery and Reinvestment Act of 2009 (ARRA), Pub. L. No. 111-5, H. R. 1 (2009) (enacted as the Health Information Technology for Economic and Clinical Health Act (HITECH) in Title XIII, Div. A, and Title IV, Div. B). 8

of the Privacy Rule. 57 Similarly, the Part 2 regulations authorize substance abuse programs to enter into agreements with Qualified Service Organizations (QSO) that provide services similar to those outlined in the current and proposed definitions for business associates, provided that the agreements specify that the QSO acknowledges the applicability of the Part 2 regulations to the services to be provided and agrees to follow them. 58 Consent for disclosure of substance abuse treatment information in an HIE States have struggled with how to create consent forms that will allow both patients and substance abuse programs to take advantage of the efficiencies of electronic exchange of health information while maintaining the now expected protections for the confidentiality of those patients PHI. Some states, such as Florida, have created a universal consent form that attempts to meet both their own state laws and federal regulations protecting sensitive health information, including compliance with Part 2 regulations. 59 Others, such as Texas, are still working to develop a consent mechanism that will allow substance abuse program information to be accessed through electronic exchanges. 60 Some states simply do not accept such information because the technical issues are not fully resolved, while still others give notice to patients that they may not wish to consent to disclosure of their PHI through an HIE. A regional provider in Connecticut, ehealth Connecticut, includes the following language in its notice to patients: Types of information included: Information accessed through the ehealthct HIE includes ALL OF your medical information, including but not limited to, sensitive information related to HIV/AIDS, mental health, genetic disease or tests, sexually transmitted diseases and family planning. Types of information NOT included: Information as it relates to treatment for alcohol, substance or drug abuse received by [the patient] in any program or by any provider 61 Utah, on the other hand, advises patients for its Utah Clinical Health Information Exchange (chie) that they may wish to opt out of participation by including this statement: The chie may also contain information about substance abuse, mental health conditions, and other conditions you may consider sensitive. Unfortunately the chie is not able to exclude specific tests, visit, or treatments. If you are concerned about some or all of your information being shared in the chie, you may want to consider opting out of the chie. 62 57 75 Fed. Reg. 40868 (July 14, 2010). 58 42 C.F.R. 2.11. 59 Universal Patient Authorization Form for Full Disclosure of Health Information for Treatment and Quality of Care, Form Florida AHCA FC4200-004 (Mar. 1, 2010). Available at http://www.fhin.net/pdf/privacyregulation/april2010/flconsentfinalfull030510.pdf. 60 TEX. HEALTH &SAFETY CODE 181.154(d). 61 http://www.ehealthconnecticut.org/linkclick.aspx?fileticket=jq7hmvyy_wm%3d&tabid=100 62 http://mychie.org/support/fau. 9

SAMHSA has issued guidance to assist substance abuse programs to address some of the specific issues that have arisen. The Part 2 regulations do not prohibit patients in a substance abuse program from consenting to disclosure of their PHI through an HIE. However, the amount of information to be disclosed must still meet a minimum necessary standard 63 as set forth in the Part 2 regulations, and the consent form will need to be structured so as to make clear what information can be disclosed to which recipients and for what purpose. The HIE system itself must have the capacity to limit different recipients access to only the kind and amount of patient information each might need to fulfill their specific request. In addition, substance abuse programs must ensure that other requirements for a valid Part 2 consent disclosure are met if information is to be submitted through an electronic health information exchange. 64 63 42 C.F.R. 2.13(a). 64 See generally SAMSHA 2010 guidance supra note 1 and SAMSHA 2011 guidance supra note 24. 10